[ossec-dev] Re: Redirecting alerts to different recipients

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Paul,

Is that what you are looking for (granular e-mail alerting)?

http://www.ossec.net/dcid/?p=75

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 5/6/07, paul sery <pgsery@xxxxxxxx> wrote:
> Hey,
>
>   I want to direct ossec alerts to the person managing the machine on
> which it occurred. I'm managing a central logging system and am feeding
> its event stream into an ossec instance. I've cobbled together a simple
> active-response script that uses the IP parameter to send the alert ID
> to the appropriate person, but also would also like to send the log
> messages that triggered the alert -- like you get in the e-mail alerts.
> Is there any way of getting that info to the active-response mechanism?
> Or perhaps I'm missing an obvious way to do the distribution.
>
> Thanks,
> Paul